The Company handles personal data in accordance with the UK GDPR and the Data Protection Act 2018. Employees must only collect, use and store personal data that they need for their role, keep it accurate, keep it secure, and delete or return it when it is no longer needed. Client and employee data must only be held on Company-approved systems.
Employees must use Company systems, email and the internet professionally and lawfully, must not share credentials, must lock their screen when away from their desk, and must not store personal data on personal devices or unapproved cloud services. Any suspected breach, lost device or phishing attempt must be reported to IT Security immediately and in any case within one hour of discovery. The Company reports qualifying personal data breaches to the Information Commissioner's Office within 72 hours where required.
Data protection, information security and privacy training is provided at induction and refreshed periodically. Employees who have questions about whether a use of personal data is permitted should contact the Company's data protection contact before acting.